CVE-2026-98540

In the Linux kernel, the following vulnerability has been resolved:

fprobe: Terminate the fgraph data list when the reservation is not filled

fprobe fgraph entry() reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns 0. fgraph reserve data() does not clear the area, so fprobe return() parses the unused tail as headers left over from an earlier call, and an exit handler can run twice or despite its entry handler asking to skip it.

Write a zero word after the last entry to terminate the walk. A zeroed slot does not decode to a NULL fprobe on the arches that encode the header into one unsigned long, since arch decode fprobe header fp() ORs in FPROBE HEADER MSB PATTERN, so make read fprobe header() return NULL for a zeroed slot.